BlazePhoenix bug bounty programs
blazephoenix.xyz Updated
BlazePhoenix runs one public program: a self-hosted disclosure program with no cash rewards.
- Top reward
- No cash
- Disclosure only
- Programs
- 1
- None pays cash
- Targets in scope
- 16
- 5 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program BlazePhoenix runs.
| Program | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|
|
BlazePhoenix
Self-hosted · Disclosure only |
No cash | Full | – | 3 days promised | Open |
-
- Safe harbor
- Full
- First response
- 3 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
16 targets. 5 excluded.
-
blazephoenix.xyz
Domains
-
blazephoenix.xyz — the swap, staking and api tabs
Domains
-
blazephoenix.xyz/mcp, /.well-known/mcp.json, /agents, llms.txt and the machine-readable files
Web
-
Website (blazephoenix.xyz swap, staking and API tabs)
Web
-
/api/quote, /api/verify, /api/stats, /api/tape, /api/openapi and the rest of blazephoenix.xyz/api
APIs
-
Public API (blazephoenix.xyz/api)
APIs
-
BlazePhoenixStaking, BlazePhoenixMathLib
Source code
-
https://github.com/blazephoenixxyz-crypto/Blaze-Phoenix-Dex/blob/main/llms.txt
Source code
-
https://github.com/security/advanced-security
Source code
-
Router, Solver, Hub, Quoter, Gate and GateWrapper, the Core and Math libraries and the BalancerV2, BalancerV3, CurveNG and CurveCryptoNG adapters — the 2.0.0 release
Source code
-
MCP server and agent surfaces (blazephoenix.xyz/mcp, @blazephoenix/mcp)
Products and areas
-
other
Products and areas
-
SDK and calldata (@blazephoenix/sdk)
Products and areas
-
Solidity contracts of the DEX aggregator (Router, Solver, Hub, Quoter, Core)
Products and areas
-
Solidity contracts of the staking engine (BlazePhoenixStaking, BlazePhoenixMathLib)
Products and areas
-
the route and calldata our API, MCP and front end hand to integrators
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 5
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
RPC providers and front-ends
-
the BZPX token itself is out of scope
-
The earlier 1.0.0 deployment, which the 2.0.0 release replaces.
-
Theoretical concerns without demonstrated impact
-
Third-party code: pools, tokens, bridges, wallets, RPC providers, Cloudflare, GitHub — unless our code consumes them unsafely.
Recent changes
Reward and scope changes across every BlazePhoenix program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
About this page
This page gathers every public program listed under blazephoenix.xyz: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.